Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/08/2024, 17:19
Static task
static1
Behavioral task
behavioral1
Sample
96f5a7edaae241cb133955754988698a_JaffaCakes118.html
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
96f5a7edaae241cb133955754988698a_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
96f5a7edaae241cb133955754988698a_JaffaCakes118.html
-
Size
30KB
-
MD5
96f5a7edaae241cb133955754988698a
-
SHA1
9c1e53cb0e259e89302b66c6621d11d80367abc0
-
SHA256
60029e017234cd4457f5537a1e6daef9b9ae88d5d1d1d4025b62d159cb763276
-
SHA512
ea10bf42228da2b0de4b44bda18f6868147f515adf087bea3b985aa57065b2409cd718dc70710160079c55f58bf025e426f205710f2fc1ab87b663cfc53a4082
-
SSDEEP
384:1u70NfBoZ+flgU9GhG3BQwE99Bsr9S4+F94gJYeKFjhbAQw3wxwfuc6SMzHQw65h:1hNMTirITm5bcTMCMbW/nTF
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 540 msedge.exe 540 msedge.exe 1576 msedge.exe 1576 msedge.exe 1480 msedge.exe 1480 msedge.exe 1480 msedge.exe 1480 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1576 msedge.exe 1576 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1576 wrote to memory of 780 1576 msedge.exe 84 PID 1576 wrote to memory of 780 1576 msedge.exe 84 PID 1576 wrote to memory of 1876 1576 msedge.exe 85 PID 1576 wrote to memory of 1876 1576 msedge.exe 85 PID 1576 wrote to memory of 1876 1576 msedge.exe 85 PID 1576 wrote to memory of 1876 1576 msedge.exe 85 PID 1576 wrote to memory of 1876 1576 msedge.exe 85 PID 1576 wrote to memory of 1876 1576 msedge.exe 85 PID 1576 wrote to memory of 1876 1576 msedge.exe 85 PID 1576 wrote to memory of 1876 1576 msedge.exe 85 PID 1576 wrote to memory of 1876 1576 msedge.exe 85 PID 1576 wrote to memory of 1876 1576 msedge.exe 85 PID 1576 wrote to memory of 1876 1576 msedge.exe 85 PID 1576 wrote to memory of 1876 1576 msedge.exe 85 PID 1576 wrote to memory of 1876 1576 msedge.exe 85 PID 1576 wrote to memory of 1876 1576 msedge.exe 85 PID 1576 wrote to memory of 1876 1576 msedge.exe 85 PID 1576 wrote to memory of 1876 1576 msedge.exe 85 PID 1576 wrote to memory of 1876 1576 msedge.exe 85 PID 1576 wrote to memory of 1876 1576 msedge.exe 85 PID 1576 wrote to memory of 1876 1576 msedge.exe 85 PID 1576 wrote to memory of 1876 1576 msedge.exe 85 PID 1576 wrote to memory of 1876 1576 msedge.exe 85 PID 1576 wrote to memory of 1876 1576 msedge.exe 85 PID 1576 wrote to memory of 1876 1576 msedge.exe 85 PID 1576 wrote to memory of 1876 1576 msedge.exe 85 PID 1576 wrote to memory of 1876 1576 msedge.exe 85 PID 1576 wrote to memory of 1876 1576 msedge.exe 85 PID 1576 wrote to memory of 1876 1576 msedge.exe 85 PID 1576 wrote to memory of 1876 1576 msedge.exe 85 PID 1576 wrote to memory of 1876 1576 msedge.exe 85 PID 1576 wrote to memory of 1876 1576 msedge.exe 85 PID 1576 wrote to memory of 1876 1576 msedge.exe 85 PID 1576 wrote to memory of 1876 1576 msedge.exe 85 PID 1576 wrote to memory of 1876 1576 msedge.exe 85 PID 1576 wrote to memory of 1876 1576 msedge.exe 85 PID 1576 wrote to memory of 1876 1576 msedge.exe 85 PID 1576 wrote to memory of 1876 1576 msedge.exe 85 PID 1576 wrote to memory of 1876 1576 msedge.exe 85 PID 1576 wrote to memory of 1876 1576 msedge.exe 85 PID 1576 wrote to memory of 1876 1576 msedge.exe 85 PID 1576 wrote to memory of 1876 1576 msedge.exe 85 PID 1576 wrote to memory of 540 1576 msedge.exe 86 PID 1576 wrote to memory of 540 1576 msedge.exe 86 PID 1576 wrote to memory of 1964 1576 msedge.exe 87 PID 1576 wrote to memory of 1964 1576 msedge.exe 87 PID 1576 wrote to memory of 1964 1576 msedge.exe 87 PID 1576 wrote to memory of 1964 1576 msedge.exe 87 PID 1576 wrote to memory of 1964 1576 msedge.exe 87 PID 1576 wrote to memory of 1964 1576 msedge.exe 87 PID 1576 wrote to memory of 1964 1576 msedge.exe 87 PID 1576 wrote to memory of 1964 1576 msedge.exe 87 PID 1576 wrote to memory of 1964 1576 msedge.exe 87 PID 1576 wrote to memory of 1964 1576 msedge.exe 87 PID 1576 wrote to memory of 1964 1576 msedge.exe 87 PID 1576 wrote to memory of 1964 1576 msedge.exe 87 PID 1576 wrote to memory of 1964 1576 msedge.exe 87 PID 1576 wrote to memory of 1964 1576 msedge.exe 87 PID 1576 wrote to memory of 1964 1576 msedge.exe 87 PID 1576 wrote to memory of 1964 1576 msedge.exe 87 PID 1576 wrote to memory of 1964 1576 msedge.exe 87 PID 1576 wrote to memory of 1964 1576 msedge.exe 87 PID 1576 wrote to memory of 1964 1576 msedge.exe 87 PID 1576 wrote to memory of 1964 1576 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\96f5a7edaae241cb133955754988698a_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa2f5446f8,0x7ffa2f544708,0x7ffa2f5447182⤵PID:780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,17563948638949923498,5326165717914364885,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:22⤵PID:1876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,17563948638949923498,5326165717914364885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,17563948638949923498,5326165717914364885,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:82⤵PID:1964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17563948638949923498,5326165717914364885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:4152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17563948638949923498,5326165717914364885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:1688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,17563948638949923498,5326165717914364885,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4828 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1480
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4176
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1712
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD59b008261dda31857d68792b46af6dd6d
SHA1e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3
SHA2569ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da
SHA51278853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10
-
Filesize
152B
MD50446fcdd21b016db1f468971fb82a488
SHA1726b91562bb75f80981f381e3c69d7d832c87c9d
SHA25662c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222
SHA5121df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31
-
Filesize
674B
MD58e632d4cde4b5c4e45872f3bed5c7e26
SHA14c87fcc82c4d724e0e94966d30e6205535caabb1
SHA2565c21a6471bae736578e5bc3ed162b9e13dc61fc1e6cb3156ba2623f3d4c76eff
SHA512bf40fc9a4ffde8f788b32b5f3ed4aff3bee4a0f9c4f4eed2a1460ee6af7b2ea94a95b9b1752b91051f3046ce0aa0af9ec0b8ffa75e52580c8de7544788bebdcd
-
Filesize
6KB
MD514d76af7288f57a3956fd5bba784cca9
SHA1cacb81ef125e81d1e53e4f2d91142e5ab5214c10
SHA256db1680b704a92aae534b65631add86fe3abd0de3cd77a475f7b4d3e88fe03119
SHA5126ae95b29e33b9086d1d3d54bdfb2fbca73ce76828719388fcd51b1bb77855cf0d3fc787b2f15b3b68f192e7ba11b7c1e0a96801b7169991e8b67a0fb443f853e
-
Filesize
6KB
MD59a46703db3bd0affb76b2017e96f4b34
SHA1159173269a86f07b9776057452a05937e756fb7b
SHA2562fb894e7c7148012ece458d0c8e35621b39481777d736123f6bec57bfc6bda0c
SHA5128062836a28498e37a1edbfa250bd03d4508eb4faa03bb12c8e1922909de1357707b6fc498001611f139c205c4dc2caf8bc946596d7f3bf1fad30325c5e5f0eb4
-
Filesize
6KB
MD5253585e6b5923e5f251561910120306a
SHA1e70a26a058db0121a08a5169067b7f4802ff1e1e
SHA256e6e55a39cbd4ac12dc5230aa6e42a610ab1bbb845a0f9ca42eaf3c3cafd6b3a1
SHA5125012749940aad3c96f39ab9f3802b1e0f2fa7dc844c6efec98708f1bb6e8ef4f1e9a2ee3b2fe33ae97c59b417c4c9d9e69741dd0c3e0ff12fcb3c239af57257b
-
Filesize
10KB
MD5b16d2518abc231bff62d46e5f1235a24
SHA1461c3a32ecca1f5123a14bf59d4b8eea461ae62a
SHA256aa0105a296d1e9870030223a51cdf95a8df363e6fb20d5ebac182fbc2b80e33a
SHA5128a719f94eee39eeef4e1d5e2a747e27f2099c8d4c2c67aa9c99d6d5ca60a8bd29492f229e37f67d9c16ea9e440b0c7b8ad3e71e872474c866e7467084cc95151